The operation that cloned Western newspapers to launder Kremlin propaganda was never a shadowy troll farm. It was a Moscow marketing company with clients, deadlines, and after-action reports, and a cache of its own leaked documents now shows how it planned everything down to severed pig heads left at Paris mosques.
Readers of this site already know the outline of Operation Doppelganger, the Russian campaign that built near-perfect imitations of trusted Western outlets to push pro-Kremlin narratives and rebuilt itself within a day of every takedown. What has been harder to see is the organisation behind it. A large leak of internal documents, reported in 2026, has now pulled back the curtain on that organisation, and the picture it reveals is less a clandestine intelligence cell than a professional agency running influence operations the way a marketing firm runs ad campaigns.
From cloned outlets to the company that cloned them
The firm is the Social Design Agency, headed by Ilya Gambashidze. Western governments had already identified it as central to Russia’s disinformation apparatus, with leaked records tying it to a vast campaign against Ukraine and the EU. The United States Treasury sanctioned Gambashidze and his agency in 2024 for their role in the operation that produced fake versions of Western media, and the European Union followed. France’s fact-checkers and government analysts had traced Doppelganger’s cloned sites back toward this same infrastructure, which is why France24 once profiled Gambashidze as a candidate for the title of king of Russia’s trolls.
The new material moves the story from attribution to documentation. Rather than outside researchers inferring the agency’s hand, the leak provides the agency’s own paperwork: its plans, its target lists, and its self-assessments of how its operations performed.
“Cognitive strikes”
The investigation published by OCCRP, drawn from files obtained by reporters at Delfi Estonia and shared with a consortium of outlets, describes how the agency conceived of its work. The documents speak of delivering consecutive “cognitive strikes” against Western audiences, carried out on the internet platforms the operation controlled, and increasingly through indirect methods that abandoned overtly pro-Russian messaging in favour of something harder to trace. The vocabulary is telling. It frames disinformation not as commentary but as a series of blows aimed at a population’s ability to reason about events, planned and measured like a military campaign.
The files also show a chain of accountability running upward into the Russian state. According to the reporting, an official in the presidential administration had the authority to demand explanations from Gambashidze when something went wrong, placing the agency inside a supervised relationship with the Kremlin rather than off to one side of it. Earlier leaked files from the same troll factory had already shown the agency tracking European elections in granular detail.
Operation Pig’s Head
The most disturbing item in the cache moves the story off the screen and into the street. In September 2025, nine mosques and Muslim cultural centres in the Paris area were found with severed pig heads left outside them, several marked with the name “Macron” in blue ink. At the time the incident looked like a hate crime by unknown perpetrators. The leaked documents recast it as a planned operation.
A file titled “Report on Operation Pig’s Head,” as detailed by OCCRP, laid out the logistics with bureaucratic calm. Operatives arrived on 7 September, conducted reconnaissance on 8 September, distributed the pig heads on 9 September, and left. The report then assessed the result in the only terms the agency seemed to care about, noting with evident satisfaction that the operation had received wide coverage in world media. The aim was never the pig heads themselves. It was the reaction they would provoke: to inflame tensions between France’s Muslim population and the rest of society, to make the country look divided and ungovernable, and to generate exactly the kind of coverage the agency could then point to as proof of its own effectiveness. This is the detail that should reframe how the whole operation is understood. The Social Design Agency was not confined to the digital domain. It was willing to stage physical provocations in a European capital and treat the ensuing outrage as a campaign metric.
A client, not a cause
Everything in the leak reinforces the same theme, which is that this is a business. The agency worked to briefs, tracked its performance, wrote up its operations, and reported to a customer. Its target list ran across France, Germany, Austria, Hungary, Slovakia, and Armenia, and reached into Kazakhstan and the wider Caspian and Central Asian region. The breadth is the breadth of a firm chasing contracts, not a movement chasing a belief.
That framing matters for how these operations should be countered. A true believer is hard to deter because the belief is the point. A contractor is a different proposition. A contractor has budgets that can be squeezed, a reputation with a client that can be damaged, personnel who can be sanctioned and named, and infrastructure that costs money to rebuild. The sanctions already imposed on Gambashidze and his agency work on exactly this logic, treating the operation as an enterprise with pressure points rather than a phantom.
Outcome and what changed
The leak, published in 2026 from files obtained by Delfi Estonia and shared through OCCRP’s partners, changed the evidentiary picture rather than the operational one. Gambashidze and the Social Design Agency were already under U.S. and EU sanctions, and the documents did not stop the work. Even as the files surfaced, the same agency was being tracked running Operation Undercut against Moldova’s 2025 election, using AI avatars to narrate Kremlin content to Romanian speakers, which tells you the firm kept operating straight through its own exposure.
What changed is what the public can now say with certainty. Knowing that fake versions of Le Monde and the Washington Post existed told the world what was being done. The internal files tell it who was doing it, how they thought about it, and how far they were willing to go, in the operators’ own words. The distance between an accusation and a confession is enormous, and this leak closed much of it. Russia’s most sophisticated disinformation is produced by professionals who plan cognitive strikes, service a state client, keep score, and step off the internet into the physical world when it suits them. The fake news sites were only the visible product. The leak showed the company, and the company is still in business.
Leave a Reply